Fortinet has released emergency patches for a severe security vulnerability impacting its FortiOS SSL-VPN solution said to have been exploited in real-world attacks.

Tracked as CVE-2022-42475, the bug is a heap-based buffer overflow issue that allows a remote attacker to execute arbitrary code on the system. The vulnerability exists due to a boundary error within the sslvpnd daemon. A remote non-authenticated attacker can pass specially crafted data to the SSL-VPN interface, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

The issue impacts the following products: FortiOS version 7.2.0 through 7.2.2; FortiOS version 7.0.0 through 7.0.8; FortiOS version 6.4.0 through 6.4.10; FortiOS version 6.2.0 through 6.2.11; FortiOS-6K7K version 7.0.0; through 7.0.7; FortiOS-6K7K version 6.4.0 through 6.4.9; FortiOS-6K7K version 6.2.0 through 6.2.11; FortiOS-6K7K version 6.0.0 through 6.0.14.

“Fortinet is aware of an instance where this vulnerability was exploited in the wild, and recommends immediately validating your systems against the following indicators of compromise,” the company warned in its security advisory, urging customers to update their appliances.

The vendor has also provided indicators of compromise (IoCs), including a list of IP addresses observed exploiting the vulnerability, to help defenders detect infections.